Error message 'Resource not accessible by personal access token' when trying to perform mutation in GraphQL

[carlosolimpio]

Select Topic Area

Question

Body

I'm trying to build a simple Android app to list repositories and be able to add a star to certain repos. Every time when I try to do a mutation to add a star to a project using Altair I get the error message bellow, but when I perform the same mutation from Github GraphQL Explorer the mutation is executed and the star is given to the repository. Why?

If is possible to give stars to public repos, how do I do it?
If is not possible using the PAT why is available in the docs?

Mutation:

mutation AddStarMutation($id: ID!) { 
  addStar(input: {
    starrableId: $id
  }) {
    starrable {
      id
      stargazerCount
      viewerHasStarred
    }
  }
}

Error message:

{
  "data": {
    "addStar": null
  },
  "errors": [
    {
      "type": "FORBIDDEN",
      "path": [
        "addStar"
      ],
      "extensions": {
        "saml_failure": false
      },
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "message": "Resource not accessible by personal access token"
    }
  ]
}

The following configuration for permissions are being used for the token:

Am I missing something?

[carlosolimpio]

Turned out what I was missing is to perform mutations on behalf a user you have to provide a login using the OAuth2 app authentication method. This way you prompt the permissions your app is using on behalf of the user. Check here in the docs: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps

Ps: I had checked this docs before posting the question but did not get the purpose of OAuth2 apps.